Location, timing—and a rapist’s fantasy focusing in on an unsuspecting victim in bed, at home alone.

Those factors were all integral to a succcessful search warrant served on Google, allowing detectives to pinpoint an accused serial rapist in eastern Pennsylvania last year, according to newly-released court documents.

The court order tracing an electronic trail back to the computer of John E. Kurtz was granted in September 2016. The order was obtained this week by Forensic Magazine after it was unsealed by the Northumberland County courts.

Such court orders can be difficult to obtain, since the probable cause has to be more compelling than a mere “fishing expedition” to Google or other massive troves of electronic data, legal experts told Forensic Magazine.

But in this case, the Pennsylvania state trooper cited specific reasons he believed the serial rapist would have been Googling his second victim in the days or even hours before the attack: the time, the location, and the attacker’s fantasy about the woman.

Kurtz, a 43-year-old prison guard, was arrested Dec. 18 and charged with multiple felony counts for three incidents: the kidnapping and rape of two women in 2016 and 2017, and the attempting kidnapping of a third woman in 2012. (Even before he was arrested in late 2017, the three cases had been linked by DNA he had failed to clean from the scene.)

Kurtz remains behind bars currently, and his attorney could not be reached before deadline.

‘NOT RANDOMLY TARGETED’

The application for a search warrant on Google was based off the second incident, early in the morning of July 20, 2016 in Turbot Township.

The 29-year-old woman was asleep in her bed, in her home on Schreck Road, in a rural part of the township, that night. She was awakened before 2 a.m. by her dogs barking, according to the court documents. She went to see what it was, found nothing and went back to bed. But 20 minutes later, they began barking again. She went to investigate, and again didn’t see or hear anything.

But before she could return to bed, she was confronted by an unknown man in her hallway coming out of another bedroom. The struggle between the two ended with her hands zip-tied behind her back, her being gagged and blindfolded, and then choked to unconsciousness.

She was dragged out to the man’s car, then driven away. The trip lasted 45 minutes, before they arrived at the unknown destination. She was taken out into an unknown indoor location, raped, cleaned with antiseptic wipes, and then dragged back out to the car. She was dropped off by the rapist at a cornfield within a mile of her home. She walked to a nearby home, where 911 was called after the rapist had already made his getaway, according to the court documents.

Investigators listened to the woman’s story—and based off the perpetrator's actions and his words, they constructed a case for probable cause. The Pennsylvania State Police investigators believed:

Stalking had been involved in the lead-up to the attack.

“Based off of the assessment of the incident, it is believed that the Actor was very familiar with the victim and the victim was not randomly targeted,” the trooper wrote in the application. “Most sexual offenders of this magnitude are predominantly fantasy driven, which could have occurred over a lengthy period of time.

“It is believed that the Actor may have fantasized about the victim, after seeing or becoming aware of her, and it is likely he followed her back to her address.”

Location of the victim’s home was key to the searching of the records.

“The victim’s residence was also not randomly targeted,” the detective wrote. “The victim lives in a very small rural development outside the borough of Milton, PA and the whereabouts are likely unknown by most.”

Timing was another important factor. According to the initial arrest affidavit, the victim’s husband was working a shift at the SCI—Coal Township state prison until 6 a.m. that morning. The rapist, when he struck before 2 a.m., was reasonably confident that the victim would be alone in her secluded home when he broke inside.

“Furthermore, it is believed that the Actor knew that the victim’s husband was not home at the time of the entry in the residence,” according to the search warrant request.

The Google search engine would have allowed the rapist to indulge in his fantasy, they reasoned. The assailant would have used the most ubiquitous search engine (with its mapping function) to find out more about her, and to plot out his middle-of-the-night attack, the trooper wrote in his application.

“Furthermore, it is believed that the Actor also research the victim’s address and/or victim utilizing the internet or search engine similar to the searches provided by Google, Inc.,” the investigator wrote.

A CRUCIAL WEEK OF TARGETED DATA

The attack took place in the early morning hours of a Wednesday.

So the state trooper sought records from the seven days leading up to the violent home invasion and attack.

All mentions of the victim’s name, whether through web hits or images, were sought, according to the application for the search warrant.

Also sought were all the Google Search and Google Map queries for the woman’s address.

The judge agreed. Senior Common Pleas Judge Harold Woelfel approved the search warrant, issuing a court order the same day of the application: Sept. 14, 2016.

Legal experts told Forensic Magazine that the threshold for determining probable cause with such searches is not easy. To go from a “could be” scenario to a “probably is” case to seek out the records can be difficult, said Rockne Harmon, a retired Alameda County (Calif.) prosecutor perhaps best known for his work as the DNA expert at the O.J. Simpson trial in 1995.

The Pennsylvania State Police troopers narrowed down their request and explained why those records would probably lead to the serial rapist they sought, Harmon explained.

“You’ve got some smart guys there,” said Harmon.

A YEAR LATER, AN IP ADDRESS

The order was issued to Google electronically the same day it was signed in 2016.

In the meantime, a third woman was attacked by the same unidentified rapist on April 23, 2017 in Dornsrife, Pa. All three attacks were linked to the unknown attacker by DNA, despite his attempts to clean the victims or otherwise remove his biological traces from the scenes and evidence.

About three hours before the intruder appeared in the Turbot Township home, someone using an IP address 50.29.232.XXX (redacted here) had searched for the address, complete with pictures.

The trooper then performed a public records check through the American Registry for Internet Numbers. That database pointed to PenTeleData, Inc., hosting the IP address.

Two days afterward, another judge of the Court of Common Pleas in Northumberland County issued a court order directing PenTeleData to provide the IP address user’s name, and other customer records.

Three days after that, PenTeleData responded with all the information.

A NAME, AN ADDRESS—AND A DNA HIT

John E. Kurtz, of 14 North 8th Street in Shamokin, had been using a two-way cable modem Internet access at the IP address since April 2011. And it was still active, PenTeleData responded.

Kurtz was a prison guard with the Pennsylvania Department of Corrections. And he worked at the same prison where the second victim’s husband had been working the night shift at the time of the July 20, 2016 attack.

State troopers interviewed DOC personnel, and started learning about his work schedule—and how much he would know about his coworker’s schedules. Among other things, they learned he had training on the use of restraints like zip ties.

Kurtz also had not been working at the time of any of the three attacks, according to the affidavit.

The Pennsylvania investigators then obtained a court order to track and trace Kurtz’s cellphone the next day, according to the affidavit. Twenty-four hour surveillance started that same day, and troopers followed him around in the towns where he lived and worked.

The DNA from those butts matched the DNA from the rapist responsible for the three attacks, state police determined.

“The probability of randomly selecting a related individual exhibiting this combination of DNA types is approximately 1 in 1.3 octillion from the Caucasian population,” according to the arrest affidavit.

Google has not responded to multiple requests from Forensic Magazine concerning the Kurtz case.

But multiple news accounts describe how they dispute legal requests for users’ information. For instance, they fought a search warrant out of Minnesota to find anyone who had searched the name of a person whose identity had been stolen.

Google’s “Transparency Report” shows a steady increase in user data requests. The six-month totals for the second half of 2016, when the Pennsylvania State Police request was made, was 45,550—about four times the total reported for the second half of 2009.

Disable Cookies per browser:

Note: If you are using a browser that is not listed here, please do a quick internet search on how to block cookies and tracking for your specific browser.

This website uses cookies to ensure you get the best user experience. If you agree to accept these cookies, confirm by clicking the "Ok, I Agree" button. For instructions on how to block cookies from this site, please click the "Give Me More Info" button.